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REMARKS 

The applicant has amended the specification to correct a typographical error. The 
amendment does not introduce new matter. 

The examiner rejected each claim as anticipated by Rowland, U.S. Patent No. 6,405,318. 
As best understood, the examiner understands Rowland's description of a user logging into and 
logging out of a user account to correspond to receiving a query from a user. As amended, 
however, claim 1 requires "receiving a database query from a user." Rowland neither describes 
nor suggests this element. Indeed, Rowland does not discuss databases at all. 

Furthermore, as amended, claim 1 requires 

defining at least one intrusion detection profile, each profile including a set of 
item access rates, one of which includes a definition of a number of rows that may 
be accessed in a predetermined period of time . 

As best understood, the examiner considers the intrusion detection profile to correspond 
to the login anomaly detector and logout anomaly detector, described in Rowland's FIGS. 3, 5 A, 
and 5B, or to the port scan detector or session monitor described in Rowland's FIGS. 6 and 7. 
Rowland describes these modules as detecting anomalous user activity. In particular, Rowland 
describes checking: 

• whether the user has logged in from a foreign domain (FIG. 3, ref 26); 

• whether the user is currently logged in multiple times (FIG. 3, ref. 28); 

• whether the user is logged in at an abnormal time of day (FIG. 3, ref. 30); 

• whether the user's login matches a known attack pattern (FIG. 3, ref. 34); 

• whether the user's history file has been compromised (FIG. 5 A, ref. 51); 

• whether a host file has a dangerous modification (FIG. 5A, ref. 56); 

• whether the home directory has a suspicious modification (FIG. 5A, ref. 59); 

• whether network processes remain active after the user has logged out (FIG. 5B, 
ref. 63); 

• whether an audit record has been altered or is missing (FIG. 5B, ref. 66); 

• whether a generic file exists (FIG. 5B, ref 67); 
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• whether a directory name is suspicious (FIG. 5B, ref. 66); and 

• whether a .rhosts file exists (FIG. 5B, ref. 69). 

Rowland also discloses tests relating to network ports (FIG. 6) and to user activity while 
the user is logged in, comparing the activity to certain known (but unspecified) attack patterns 
and threat events (FIG. 7, ref. 95). 

Thus, although Rowland discloses many ways to detect anomalous user activity, none of 
those ways involves an item access rate. In none of Rowland's examples does he define "a 
number of rows that may be accessed in a predetermined period of time," as required by claim 1. 

The remaining claims contain all of the limitations of claim 1, and are patentable for at 
least the same reasons. 

Applicant amends the claims solely to expedite prosecution of this application or to 
clarify the intended scope of the claims. The amendments are not to be construed as an 
admission that the claims prior to amendment are unpatentable. Furthermore, in addition to the 
above arguments, there may be other good grounds for patentability of the claims. 

Enclosed is a $120 check for the Petition for Extension of Time fee. Please apply any 
other charges or credits to deposit account 06-1050. 
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